CVE-2025-71430: Frappe before 15.91.1 Stored XSS via Leaderboard User Names
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 14.99.10 are affected, as are 15.x versions before 15.91.1. The vulnerable rendering occurs on the leaderboard page.
What access does an attacker need?
An attacker needs an authenticated account and the ability to set a crafted user name. Exploitation also requires another user to view the leaderboard containing that name.
What is the practical impact if exploitation succeeds?
The crafted user name can execute arbitrary JavaScript in the browser of a user viewing the leaderboard. The stated impact includes potential loss of confidentiality and integrity in the affected user's browser context.
How can I determine whether exploitation may have occurred?
Review user names for suspicious markup or script-like content, particularly for accounts that may appear on the leaderboard. Also review access or application logs for leaderboard views by users after such names were set, if those records are available.